By: Ross A. Boden

The construction industry is a leading target of cyber crime.  The necessity of remote network access on job sites and the use of shared networks among vendors and contractors have made the construction industry a vulnerable target and a notorious entry point for major security breaches.  According to cybersecurity firms, one in every 382 e-mails in the construction industry contains malicious content, and nearly forty percent of construction industry employees are considered susceptible to cyber scams. Given that cyber crime will only get more sophisticated and difficult to detect, failing to implement a cybersecurity plan is a serious gamble. 

According to the National Cyber Security Alliance, 60% of small businesses survive less than six months following a data breach. However, contractors can improve those odds by increasing security measures, training employees, and purchasing cyber insurance policies.   Furthermore, contractors without cybersecurity plans may fall behind competitors and fail to qualify for certain jobs, especially government projects. 

Importantly, recent cybersecurity studies put the construction industry on high alert after showing how cyber terrorists could hijack heavy equipment or manipulate structural calculations. Thus, there is far more at stake than data and competitive edge. Contractors big and small must be prepared to curb these cybersecurity threats.     

Cyber Criminals Attack Contractors of All Sizes

If you believe cyber criminals target only large contractors, think again. Cyber criminals attack contractors of all sizes, and in fact, construction firms with less than 250 employees face the highest rate of cyber-attacks.  Furthermore, the potential exposure includes not only the contractor’s own data but also any data to which the contractor has access. This is why it is imperative for all contractors to improve cybersecurity preparedness. Hackers need only one weak link for a massive security breach.    

A prime example is the infamous data breach at Target in 2013. An HVAC contractor had access to Target’s networks for the purpose of installing smart thermostats in Target stores.  Hackers penetrated Target’s network through the HVAC contractor and stole data from approximately 40 million customers. The breach cost more than $200 million, an insurmountable liability for most contractors. 

Common Cybersecurity Threats to Know About

Implementing sound cybersecurity policies requires a basic understanding of common security threats.  Hackers constantly change methods, but there are common cyber scams that every construction professional should know about:

Ransomware: This is a form of malware that prevents access to computer systems, e-mail, and data until a ransom is paid. The ransom is typically low enough ($1,000 to $25,000) to make it cheaper than the business interruption, negative publicity, and repair costs. Hackers usually demand the ransom to be paid in cryptocurrency (such as Bitcoin), which is difficult to trace. Even if the ransom is paid, hackers may destroy the data or attack again until the security breach is cured.    

Phishing: These scams often try duping employees (or customers) into revealing sensitive information or diverting payments. Like all cyber scams, it is continually more sophisticated and difficult to detect. A classic example is an e-mail from a customer, a reputable source, or a superior with an urgent request to provide sensitive information, click on a malicious link, open an infected attachment, or visit a fake website to enter login credentials for a sensitive account.  

Denial of Service: This attack comes in many different forms which are designed to disrupt or flood the targeted server, website, or network until it crashes. These attacks generally do not include a theft or loss of significant information or data, but they are costly and disruptive.

Spyware: This is a form of malware designed to monitor the target’s device activity or gather information on the target’s device. It can monitor keystrokes, clicks, and internet activity. It is a common way to steal usernames and passwords.

Sabotage, Manipulation, or Terrorism: In the construction industry, a few possible examples could include sabotaging designs, manipulating structural calculations, or taking control of a crane remotely. 

Cybersecurity Practice Tips

            A robust cybersecurity plan has many layers. While it is highly recommended that construction leaders educate themselves as much as possible and remain actively involved in the implementation, this is not a do-it-yourself task.  Engage a professional team to explain the options, requirements, costs, and risks involved. The plan should be a collaborative effort of cyber security consultants, insurers, software vendors, attorneys, and other professional advisors. Synthesizing their different perspectives will achieve better results. Common components of cybersecurity protection include:

• Training employees and controlling access[1]     
• Installing firewalls, antivirus, and data encryption software
• Requiring privileged account security on all devices and cloud access
• Backing up data with daily updates
• Advanced threat detection
• Requiring complex passwords
• Regularly updating security systems, software, and passwords
• Developing specific procedures for reporting and responding to attacks
• Designate a response team and point person 
• Cyber insurance (more thoroughly discussed below)
• Attorneys drafting favorable contract provisions to reduce potential exposure with vendors and other contractors

Keep in mind that thwarting all cyber threats is not possible.  The goal is to minimize vulnerabilities with the most cost-effective use of resources and to be prepared when a cyber-attack hits. 

Cyber Insurance Is Highly Recommended

            Purchasing cyber insurance is a crucial part of being prepared. Cyber insurance policies and coverages vary significantly, and many general liability and property insurance policies do not provide coverage for losses or liabilities caused by cyber crimes. Contractors should discuss coverage options and limits with their insurance agents and cybersecurity advisors.

            Contact a qualified attorney if you need help interpreting the policy, and be sure to know whether your policy covers: (1) data breaches (including recovery and replacement of lost or stolen information or data); (2) attacks originating from anywhere in the world and not just the United States; (3) attacks of your data in the possession of vendors and third parties; (4) damage to your computer systems, servers, and network; (5) acts of war (some cyber-attacks come from government actors and could be deemed an act of war, which is a common exclusion); (6) terrorist acts (another common exclusion that is becoming increasingly prevalent); (7) attorneys’ fees to evaluate your notification and regulatory obligations after an attack; (8) attorneys’ fees to defend you in a lawsuit, any regulatory investigation, and responding to any regulatory inquiries; (9) fees for public relations or crisis management assistance; (10) forensic expert fees to investigate and fix the breach; (11) fees for customer notification assistance or call center services; (12) cyber ransom and extortion fees; (13) fees, fines, and penalties incurred from the attack; (14) payments to consumers or customers affected by the attack; (15) any damages, judgments, or settlements paid for any claims or lawsuits; (16) all litigation costs and expert witness fees; (17) losses or liabilities related to defamation, copyright, or trademark infringement; (18) payments made by employees duped by a phishing scam; (19) losses or liabilities stemming from cybersecurity system or software failures; (20) broad definitions of Personally Identifiable Information; and (21) lost business income.  Additionally, determine whether the policy requires any annual testing or minimum security measures for coverage to be effective. 

            After a cyber-attack, always consult with your attorney before contacting your insurer.  Your attorney can help secure coverage and guard against making statements detrimental to your insurance coverage.    

Responding to Attacks

            When an attack hits, follow your cybersecurity response plan. Presumably, your response plan will include notifying your cybersecurity professionals, attorneys, employees who need to know, insurers, and law enforcement. If included in your cyber insurance policy, the insurer will hire forensic experts, crisis management teams, public relations advisors, and attorneys to assist in the aftermath.

It is highly advisable to speak with your attorney promptly after an attack. There are deadlines to report certain scams and data breaches to government agencies, and your attorney can advise on applicable requirements. Cybersecurity threats will never be eliminated, but well-prepared contractors may reduce the negative consequences.

[1] Training employees is essential.  The best cybersecurity technology is ineffective without employee training.  How many of your employees would respond to a superior’s urgent request for sensitive information, especially if the e-mail came from the superior’s actual e-mail account?  It is a scary thought.  With the turnover in construction, new hire training and periodic training is essential.  Instruct employees to remain vigilant and reward them for reporting potential concerns.  Remind employees never to click on unusual links or attachments; never respond to unusual requests; never open unexpected attachments; never divulge account numbers or passwords; never permit a third party to use your device; and avoid using removable media (flash drives, CDs, DVDs, etc.) received from third parties.  However, the best advice is to have your security professional and attorney handle the training.

Ross A. Boden is an attorney in the Kansas City office of Sandberg Phoenix P.C. and can be reached at rboden@sandbergphoenix.com or at (816) 627-5536.  Follow Sandberg Phoenix’s construction blog at:  http://www.sandbergphoenix.com/perspectives/blogs/construction-litigation-blog/